Method and apparatus for statistical handling of connections

ABSTRACT

In accordance with an example embodiment of the present invention, a method is described which comprises receiving data relating to at least one connection from a network ( 410 ), deriving statistical information relating to the at least one connection ( 420 ), and causing disconnection of at least one of the at least one connection in dependence of the statistical information ( 430 ).

RELATED APPLICATION

This application was originally filed as PCT Application No.PCT/FI2011/000002 filed Jan. 7, 2011.

TECHNICAL FIELD

The present application relates generally to management of connectionsin wireless or wire-line communication networks.

BACKGROUND

In packet-switched networks, devices may form connections to each otherby transmitting packets which are received by other connected devices.In accordance with packet-based protocols, once a connection isestablished between two devices it remains defined until it'sdisconnected. After establishment and before disconnection packets canbe exchanged between the devices, known as endpoints, within the contextof the packet-based connection. An example of a packet-based protocol isthe transmission control protocol, TCP.

Devices connected to the internet experience frequent unsolicitedattempts to form connections. The unsolicited attempts may originatefrom automatic or malicious programs that seek access to the connecteddevices and owners of connected devices typically strive to reject ordisconnect such attempts.

Connected devices or nodes in a network may be furnished with firewallsconfigured to filter traffic according to various programmableparameters. Firewalls may be programmed to block unsolicited trafficwhen characteristics of such traffic are known, and blocking suchtraffic in the network provides the advantage that the end node doesn'tneed to receive it.

Where the connected devices are mobile devices, all traffic andconnections may be communicated using electromagnetic waves and bothreception and transmission consume battery power, which may be a limitedresource. Thus in mobile connected devices battery drain is a furtherreason for owners to try to limit the impact of unsolicited attempts toform connections to their devices. Mobile communication networks definewireless bearer protocols, such as packet data protocol contexts, PDPcontexts, to convey packet-based data to and from wireless communicationdevices.

Some mobile devices are capable of communicating according to more thanone wireless protocol, for example via a cellular and a wireless localarea network, WLAN, connection. Other examples of wireless protocolsinclude Bluetooth, WiMAX and Wibree protocols which are each adapted forpacket-based communication.

SUMMARY

Various aspects of examples of the invention are set out in the claims.

According to a first aspect of the present invention there is providedan apparatus comprising a receiver configured'to receive data relatingto connections from a network, at least one processing core configuredto derive statistical information relating to the connections, theprocessing core being configured to cause the receiver to disconnect atleast one of the connections in dependence of the statisticalinformation.

According to a second aspect of the present invention, there is provideda method is which comprises receiving data relating to at least oneconnection from a network, deriving statistical information relating tothe at least one connection, and causing disconnection of at least oneof the at least one connection in dependence of the statisticalinformation.

According to a third aspect of the present invention, there is providedan apparatus, comprising at least one processor, at least one memoryincluding computer program code, the at least one memory and thecomputer program code configured to, with the at least one processor,cause the apparatus to perform at least receiving data relating to atleast one connection from a network, deriving statistical informationrelating to the at least one connection; and causing disconnection of atleast one of the at least one connection in dependence of thestatistical information.

According to a fourth aspect, there is provided a computer programconfigured to cause a method according the second aspect to be performedwhen the computer program is run on a processor. The computer programmay be encoded on a non-transitory computer-readable medium.

BRIEF DESCRIPTION OF THE DRAWINGS

For a more complete understanding of example embodiments of the presentinvention, reference is now made to the following descriptions taken inconnection with the accompanying drawings in which:

FIG. 1 illustrates an example system where embodiments of the presentinvention may be employed.

FIG. 2 illustrates an example apparatus 201 capable of supportingembodiments of the present invention.

FIG. 3 illustrates statistical information according to some embodimentsof the present invention.

FIG. 4 is a flowgraph of a process according to an example embodiment ofthe present invention.

FIG. 5 illustrates timings related to some embodiments of the presentinvention.

DETAILED DESCRIPTION OF THE DRAWINGS

An example embodiment of the present invention and its potentialadvantages are understood by referring to FIGS. 1 through 5 of thedrawings.

FIG. 1 illustrates an example system where embodiments of the presentinvention may be employed. Mobile apparatus 110, for example a mobilephone, personal digital assistant, PDA, cellular phone, palmtopcomputer, laptop or other mobile communications-capable device, isconnected to base station 120 by means of wireless link 115. Wirelesslink 115 may comprise an uplink capable of conveying information frommobile 110 to base station 120 and a downlink capable of conveyinginformation from base station 120 to mobile 110. Wireless link 115 maybe in conformance with a cellular technology such as, for example,wideband code division multiple access, WCDMA, global system for mobilecommunications, GSM or long term evolution, LTE. Mobile 110 may bepowered by a battery comprised in mobile 110.

Base station 120 may be capable of communicating in accordance with atleast one, and in some embodiments more than one, cellular technologysuch as, for example, those mentioned above. Base station 120 may bepowered from a stable power source and may be furnished with a backupbattery. Base station 120 may be connected to a core network mode 130 bymeans of connection 125. Connection 125 may be a wire-line connectionor, for example, a directional microwave link. Core network node 130 mayact as a gateway toward further nodes and may be configured to performfunctions relating to controlling a cellular communications network.Examples of such functions include routing, authentication, accesscontrol and billing subscribers. Examples of core network nodes includeswitches, management nodes, serving gateways, support nodes and chargingsystems. Core network node 130 may connect to further core networknodes, which are not illustrated, by means of connection 137. Corenetwork node 130 may connect to the internet 140 by means of connection135.

In some embodiments core network node 130 may be absent, in which casebase station 120 may be connected directly to other base stations and,optionally, the internet 140. In such cases base station 120 may befurnished with at least some of the core network functions mentionedabove. In some embodiments nodes not illustrated in FIG. 1 may bepresent, for example a base station controller node may be disposedbetween base station 120 and core network node 130.

In some embodiments, in addition to or instead of the cellular chaincomprising base station 120 and core network node 130 mobile 110 maycommunicate by means of a non-cellular chain comprising access point 150and gateway 160. Mobile 110 may communicate with access point 150 vialink 117 which may operate according to WLAN technology or WiMAXtechnology, for example. Link 117 may, like wireless link 115, comprisean uplink and a downlink. Access point 150 may be connected to gateway160 by means of connection 155. Connection 155 may be a wire-lineconnection such as an Ethernet or digital subscriber line, DSL,connection. Gateway 160 may be capable to communicate with internet 140by means of connection 165 and by further gateways by means ofconnection 167, which may both be wire-line connections or wirelessconnections. It is also possible that gateway 160 is absent, and accesspoint 150 is directly connected to internet 140.

When mobile 110 is active and attached to at least one of base station120 and access point 150, mobile 110 may be visible to nodes comprisedin the internet 140. Mobile 110 may receive connection requests from theinternet 140 from the cellular chain via core network node 130 and basestation 120, or from the non-cellular chain via gateway 160 and accesspoint 150. When mobile 110 is configured to act, for example, as aserver it is expected to receive and serve connection requestsoriginating in the internet 140 or, for example, other areas of thecellular network via connection 137 or the non-cellular network viaconnection 167. Mobile 110 may also receive unsolicited connectionrequests, such as malware requests.

Upon receiving an unwanted connection request, mobile 110 musttransition to an active state from a sleep or power-saving mode toreceive the connection request. Base station 120 or access point 150 maypage mobile 110 that an incoming connection request has been buffered.Responsive to the page, mobile 110 may transition to an active state andreceive the connection request via a downlink. When the connectionrequest isn't followed up with further messages, mobile 110 may remainin an active state until it autonomously transitions back to a sleep orpower-save mode. Cellular or non-cellular networks may define a timerthat controls how long mobile 110 will remain in an active state waitingfor further messages relating to the same connection as the connectionrequest. In WCDMA cellular networks, for example, timers T1 and T2define the length of time before a connection between mobile 110 andbase station 120 is torn down in absence of traffic. When mobile 110 isin an active state, it consumes its battery at a faster rate betweenreception of the connection request and expiry of the timer. Thusspurious connection requests cause mobile 110 to consume its batteryuselessly while it waits for further messages relating to the sameconnections as the spurious connection requests, before the timer ortimers expire.

Since spurious connection requests drain battery in mobile 110,firewalls may be defined to block them. A firewall in, for example, corenetwork node 130 may be configured with known or assumed characteristicsof spurious connection requests. Responsive to detecting a messagematching the characteristics the firewall may discard the messagewithout forwarding it. Firewalls may be configured to allow onlymessages that originate from a set of pre-defined addresses. Firewallsalso may be configured to only allow traffic originating from Internet140 from addresses mobile 110 has recently contacted. The firewall maybe programmable by mobile 110, which comprises that mobile 110 at leastpartly defines the characteristics of messages the firewall is to block.In addition to core network node 130, a firewall may also be defined inat least one of mobile 110, base station 120, access point 150 andgateway 160. Firewalls represent a tradeoff since depending on how thecharacteristics are defined, they filter out spurious traffic but mayalso filter out at least some non-spurious traffic. Where mobile 110 isconfigured to act as a server, a firewall operated by an operator of acellular network in core network node 130, for example, may not provideoptimal filtering. In order to not block any non-spurious traffic thatmobile 110 wants to serve, the owner of mobile 110 may prefer to notallow a cellular operator to operate or control a firewall with respectto traffic incoming to mobile 110.

When no firewall is configured to filter traffic incoming to mobile 110,spurious as well as non-spurious connection requests are received inmobile 110. The mobile can serve non-spurious, or legitimate, requestsnormally. Spurious connection requests cause battery drain in mobile 110as described above. Cellular and non-cellular technologies may befurnished with procedures to disconnect active connections from mobile110. Such procedures may be invoked by mobile 110 during the timeoutperiod following a connection request before expiry of a timer. Usingsuch a procedure can result in faster teardown of spurious connectionsand a saving of battery power when compared to passively waiting for atimer to expire to relinquish a connection. Therefore in some cases,actively invoking a teardown procedure can achieve part of the functionof a firewall, namely to limit the effects of unwanted, spurioustraffic.

To minimize battery drain due to spurious connection requests, mobile110 may invoke a teardown procedure, for example a fast dormancyprocedure in long term evolution, LTE, networks or a disconnectprocedure in a WLAN access, promptly responsive to receiving a spuriousconnection request. Mobile 110 may therefore decide whether a connectionrequest is to be treated as spurious responsive to receiving theconnection request. Without a teardown procedure, a connection mayremain up until at least one timer expires. Some networks andnon-cellular accesses are configured to define timers to keep openconnections that experience traffic on a continual basis, so-that theconnections don't need to be separately re-established for each packetrelating to the connection. Re-establishing a connection may entail,depending on the network, signaling and delay overhead.

Since mobile 110 may not know whether a connection request is spuriousor not, to determine whether to treat a connection request as spurious,mobile 110 may be configured to compile statistical information relatingto connection requests it receives. Mobile 110 may then invoke ateardown procedure based on the statistical information, to yield a netbattery gain when the statistical information is correct and theteardown is on average used for spurious, as opposed to non-spurious,connections. In terms of a single connection, a net battery gain can beconsidered to have been achieved when a connection is torn down when asubsequent packet relating to the connection arrives later than thedisconnect timer value set by the network or non-cellular access. Inthis case without the teardown procedure, the connection would haveremained active during the entire disconnect timer interval withoutexperiencing any incoming traffic.

The statistical information may be derived in terms of a parameter orparameters of the incoming connection requests. Examples of parametersinclude port numbers to which the connection requests arrive and sourceaddresses included in the connection requests. Another possibleparameter is a part of a source address obtained by applying a mask tothe source address. Deriving the information comprises that mobile 110monitors a connection initiated by an incoming connection request forsubsequent traffic. When the next message arrives relating to theconnection, mobile 110 records the time that elapsed between theconnection request and the next message. The statistical information maycomprise an average value of elapsed times in terms of the at least oneparameter, for example the statistical information may comprise anaverage idle time following a connection request for each port in mobile110 that receives connection requests. The statistical information mayalso comprise separately an average idle time for each combination ofport and source address. Mobile 110 may be configured to collect a setnumber of connections before defining an average, for example 20, 40 or80 connections. Using a mask to obtain a part of the source addressallows mobile 110 to derive statistical information for trafficoriginating from a certain higher-level domain such as a country.

Average values comprised in the statistical information may be definedas running averages, for example running averages of the past 20, 40 or80 connections pertaining to the parameter or combination of parameters.This allows mobile 110 to learn malware patterns, for example wheremalware that is active toward mobile 110 transmits spurious connectionrequests to a first port of mobile 110, the statistical information willafter a certain time indicate that connection requests received at thefirst port are not followed up by subsequent traffic. In this case, theaverage idle time associated with the first port is long and mobile 110will conserve battery by invoking a teardown procedure responsive toreceiving a connection request at the first port. The same applies ifconnection requests arriving to the first port from a certain addresshave a long average idle time, while connection request arriving to thefirst port from other addresses may be legitimate traffic. In this case,mobile 110 may be configured to invoke a teardown process responsive toreceiving a connection request to the first port from the certainaddress. That the averages can, in some embodiments, be made runningaverages allows mobile 110 to adapt to malware patterns that change as afunction of time. It's possible, for example, that a new malware programbecomes active or that an active one becomes inactive.

In order to detect that an average idle time associated with a certainparameter or combination of parameters decreases, mobile 110 may beconfigured to forego invoking a teardown procedure for a minority ofincoming connection requests, for example for every tenth or twentieth.This way mobile 110 will be able to measure the elapsed time fromconnection request to a subsequent message without interrupting theperiod with a teardown procedure. Alternatively mobile 110 may beconfigured to invoke the teardown procedure for all incoming connectionrequests for which the statistical information indicates the expectedidle time would be long, but retain the capability to associatesubsequent traffic with the connection requests in order to maintain arunning average of the idle time. This can be achieved, for example, bystoring in memory characteristics of the connection request prior toinvoking the teardown process. Deciding whether to invoke the teardownprocess can be based on comparing an expected idle time comprised in thestatistical information to a threshold idle time. Responsive to theexpected idle time exceeding the threshold idle time, teardown can beinvoked. The threshold idle time may correspond, for example, thetimeout timer value defined by the cellular or non-cellular network, orthat timer value multiplied by two, for example.

FIG. 2 illustrates an example apparatus 201 capable of supportingembodiments of the present invention. The apparatus may correspond toapparatus 110, base station 120 or a node in core network 130 of FIG. 1,for example. The apparatus is a physically tangible object, for examplea mobile telephone, personal digital assistant, data dongle or a similardevice. The apparatus may comprise a control apparatus 210, for examplea digital signal processor, DSP, processor, field-programmable gatearray, FPGA, application-specific integrated circuit, ASIC, chipset orcontroller. The apparatus may further comprise a transmitter and/or areceiver 210 a configured to enable the apparatus 201 to connect toother apparatuses. A combination of transmitter and receiver may becalled a transceiver. The apparatus may comprise memory 210 b configuredto store information, for example statistical information. The memorymay be solid-state memory, dynamic random access memory, DRAM, magnetic,holographic or other kind of memory. The apparatus may comprise logiccircuitry 210 c configured to access the memory 210 b and control thetransmitter and/or a receiver 210 a. The logic circuitry 210 c may beimplemented as software, hardware or a combination of software andhardware. The logic circuitry may comprise a processing core. The logiccircuitry 210 c may execute program code stored in memory 210 b tocontrol the functioning of the apparatus 201 and cause it to performfunctions related to embodiments of the invention. The logic circuitry210 c may be configured to initiate functions in the apparatus 201, forexample the sending of data units via the transmitter and/or a receiver210 a. The logic circuitry 210 c may be control circuitry. Thetransmitter and/or a receiver 210 a, memory 210 b and/or logic circuitry210 c may comprise hardware and/or software elements comprised in thecontrol apparatus 210. Memory 210 b may be comprised in the controlapparatus 210, be external to it or be both external and internal to thecontrol apparatus 210 such that the memory is split to an external partand an internal part. If the apparatus 201 does not comprise a controlapparatus 210 the transmitter and/or a receiver 210 a, memory 210 b andlogic circuitry 210 c may be comprised in the apparatus as hardwareelements such as integrated circuits or other electronic components. Thesame applies if the apparatus 201 does comprise a control apparatus 210but some, or all, of the transmitter and/or a receiver 210 a, memory 210b and logic circuitry 210 c are not comprised in the control apparatus210. In embodiments where apparatus 201 is a mobile user equipment,apparatus 201 may comprise at least one antenna.

FIG. 3 illustrates statistical information according to some embodimentsof the present invention. In the upper section of FIG. 3 is illustratedstatistical information according to some embodiments of the invention.Mobile 110 is in these embodiments configured to derive statisticalinformation comprising average idle times per port. In the illustratedexample, connection requests arriving at port 82 have a long idle timeand are candidates for invoking a teardown procedure for quicktermination of the connection. Requests arriving at ports 70 and 80 haveaverage idle times of less than a second and probably represent for themost part legitimate traffic. The threshold idle time is not illustratedin FIG. 3 and decisions whether to invoke teardown may depend on it inaddition to the statistical information illustrated.

The lower part of FIG. 3 illustrates statistical information accordingto further embodiments of the invention. Mobile 110 is in theseembodiments configured to derive statistical information comprisingaverage idle times per port and highest two octets of connection requestsource address. In the illustrated example requests arriving at port 82from the subnet defined by highest two octets 91.170 have a long averageidle time and are candidates for termination by invoking a teardownprocedure. Connection requests arriving at port 70 from the subnetdefined by highest two octets 192.100 have a low average idle time, asdo those arriving at port 82 from the subnet defined by highest twooctets 91.172. In this case, mobile 110 is able to differentiate betweentraffic arriving at port 82 from different addresses, which provides formore selectivity in invoking a teardown procedure for the correspondingconnections.

In some embodiments mobile 110 may be configured to increase the levelof selectivity responsive to determining that connection requestsassociated with a parameter have a high average idle time. For examplein the upper part of FIG. 3 mobile 110 may determine that connectionrequests arriving at port 82 are associated with a high average idletime. Mobile 110 may responsively compile separate statisticalinformation on port 82 based on source address or part thereof, such asin the lower part of FIG. 3. This way the teardown procedure is appliedmore selectively.

It should be recognized that IPv4 is used in FIG. 3 only as an exampleand the invention is by no means limited thereto, for example IPv6 oranother addressing scheme being equally suitable in embodiments that useaddresses or parts thereof as parameters. It should also be recognizedthat an average idle time isn't always an actual idle time for eacharriving connection request. For example, both malware-originated, orspurious, and legitimate, or non-spurious, traffic may arrive at thesame port. It may occasionally occur that a legitimate connection istorn down based on the statistical information. In this case theconnection is re-established as subsequent packets arrive pertaining tothe non-spurious connection. Re-establishing the connection may causesome signaling that wouldn't be necessary if the connection hadn't beentorn down. Re-establishing the connection may also cause some delay.While such signaling is associated with a drain on battery resources ofmobile 110, a net gain in battery use is nonetheless achieved as long asthe teardown procedure is usually invoked correctly based on thestatistical information. In other words a benefit is achieved when thebattery gain from correctly terminated spurious connections outweighsthe battery drain from restoring incorrectly terminated non-spuriousconnections.

FIG. 4 is a flowgraph of a process according to an example embodiment ofthe present invention. In phase 410, an apparatus, for example mobile110 or an apparatus comprised in mobile 110, receives data relating toat least one connection from a network. The information may becomprised, for example, in connection requests and the information maycomprise parameters, such as destination port and source address.

In phase 420 of the process, statistical information is derived whichrelates to at least one connection. The statistical information maycorrespond, for example, to information illustrated in FIG. 3 anddiscussed above. The statistical information may be derived in terms ofat least one parameter. The statistical information may be stored in amemory comprised in mobile 110.

In phase 430 of the process, a connection is disconnected, or caused tobe disconnected, in dependence of the statistical information andinformation relating to the connection. For example, if the statisticalinformation indicates that connections relating to connection requestswith parameters that match those of the connection request relating tothe connection to be disconnected have an average idle time exceeding athreshold idle time, the connection may be disconnected. The statisticalinformation may comprise average idle times that are running, or moving,averages.

In one embodiment, a node comprised in a network is configured toperform phases 410, 420 and 430. The node may be a base station, basestation controller, radio network controller, support node, switchingcentre, mobility management entity or serving gateway, for example. Thenetwork node may be in the path of the connection to be disconnected orthe network node may in other ways participate in establishing and/ormaintaining the connection. In this embodiment, disconnecting in phase430 may comprise transmitting to mobile 110 a shortened timeout valuerelating to the connection or transmitting to mobile 110 a messagecomprising a disconnection instruction. Disconnecting in phase 430 mayalternatively comprise causing another network node to transmit ashortened timeout value relating to the connection, or a messagecomprising a disconnection indication, to mobile 110.

FIG. 5 illustrates timings related to some embodiments of the presentinvention. In the figure time is on the horizontal axis and increasesfrom left to right. A threshold idle time is illustrated as a verticalline, which is labeled THR. Labels 510, 520 and 530 correspond toparameter values, or combinations of parameter values such as, forexample, port numbers or combinations of port numbers and sourceaddresses. In the illustrated example, labels 510 and 530 correspond toparameters of connection requests that relate to connections withaverage idle times less than the threshold idle time and 520 correspondsto parameters of connection requests that relate to connections withaverage idle times exceeding the threshold idle time. The threshold idletime may correspond to a timeout value set by a cellular or non-cellularnetwork. The timeout value may be a time that a mobile attached to thecellular or non-cellular network keeps open a connection with no trafficbefore disconnecting it. An example of a timeout value is the timers T1and T2 of WCDMA networks.

Without in any way limiting the scope, interpretation, or application ofthe claims appearing below, a technical effect of one or more of theexample embodiments disclosed herein is that battery resources can beconserved by proactively disconnecting malware-related connections tomobile devices, such as for example mobile servers. Another technicaleffect of one or more of the example embodiments disclosed herein isthat selectivity of proactive disconnection can be increased to improvethe accuracy of discrimination between spurious and non-spuriousconnection requests. Another technical effect of one or more of theexample embodiments disclosed herein is that the use ofoperator-controlled firewalls can be avoided for users that offer mobileserver applications.

Embodiments of the present invention may be implemented in software,hardware, application logic or a combination of software, hardware andapplication logic. The software, application logic and/or hardware mayreside on memory 210 b, for example. In an example embodiment, theapplication logic, software or an instruction set is maintained on anyone of various conventional computer-readable media. In the context ofthis document, a “computer-readable medium” may be any media or meansthat can contain, store, communicate, propagate or transport theinstructions for use by or in connection with an instruction executionsystem, apparatus, or device, such as a computer, with one example of acomputer described and depicted in FIG. 2. A computer-readable mediummay comprise a computer-readable non-transitory storage medium that maybe any media or means that can contain or store the instructions for useby or in connection with an instruction execution system, apparatus, ordevice, such as a computer. The scope of the invention comprisescomputer programs configured to cause methods according to embodimentsof the invention to be performed.

If desired, the different functions discussed herein may be performed ina different order and/or concurrently with each other. Furthermore, ifdesired, one or more of the above-described functions may be optional ormay be combined.

Although various aspects of the invention are set out in the independentclaims, other aspects of the invention comprise other combinations offeatures from the described embodiments and/or the dependent claims withthe features of the independent claims, and not solely the combinationsexplicitly set out in the claims.

It is also noted herein that while the above describes exampleembodiments of the invention, these descriptions should not be viewed ina limiting sense. Rather, there are several variations and modificationswhich may be made without departing from the scope of the presentinvention as defined in the appended claims.

What is claimed is:
 1. An apparatus, comprising: a receiver configuredto receive data relating to connections from a network; at least oneprocessing core configured to derive statistical information relating tothe connections; the at least one processing core being configured tocause disconnection of at least one first connection in dependence ofthe statistical information, and wherein the statistical informationcomprises at least one average idle time, wherein the at least oneprocessing core is configured to cause disconnection of the at least onefirst connection responsive to an average idle time exceeding apredefined threshold idle time, the average idle time being obtainedfrom averaging idle times of a plurality of second connections, distinctfrom the first connection, the second connections having a parameterthat matches a corresponding parameter of the first connection.
 2. Theapparatus according to claim 1, wherein the statistical informationcomprises information concerning the connections in terms of at leastone parameter.
 3. The apparatus according to claim 2, wherein the atleast one parameter comprises at least one of port number, sourceaddress and a part of a source address obtained by applying a mask tothe source address.
 4. The apparatus according to claim 1, wherein theapparatus is configured to cause disconnection of the at least one firstconnection before the at least one first connection has been idle forthe predefined threshold idle time.
 5. The apparatus according to claim1, wherein the predefined threshold idle time corresponds to aconnection timeout period defined by the network.
 6. The apparatusaccording to claim 1, wherein the apparatus comprises a mobilecommunication device, the apparatus further comprising an antennacoupled to the receiver and configured to provide signals to the atleast one processing core.
 7. The apparatus according to claim 1,wherein the apparatus is comprised in a network node and causingdisconnection comprises transmitting at least one of a shortened timervalue and a disconnect message to a mobile.
 8. A method, comprising:receiving data relating to at least one connection from a network;deriving statistical information relating to the at least oneconnection; causing disconnection of at least one first connection independence of the statistical information, and wherein the statisticalinformation comprises at least one average idle time, wherein the atleast one first connection is caused to be disconnected responsive to anaverage idle time exceeding a predefined threshold idle time, theaverage idle time being obtained from averaging idle times of aplurality of second connections, distinct from the first connection, thesecond connections having a parameter that matches a correspondingparameter of the first connection.
 9. The method according to claim 8,wherein the statistical information comprises information concerning theconnections in terms of at least one parameter.
 10. The method accordingto claim 8, wherein the at least one parameter comprises at least one ofport number, source address and a part of a source address obtained byapplying a mask to the source address.
 11. The method according to claim8, wherein the at least one first connection is caused to bedisconnected before the at least one first connection has been idle forthe predefined threshold idle time.
 12. The method according to claim 8,wherein the predefined threshold idle time is a connection timeoutperiod defined by the network.
 13. The method according to claim 8,wherein causing disconnection comprises transmitting at least one of ashortened timer value and a disconnect message to a mobile.
 14. Acomputer program product comprising a non-transitory computer-readablemedium bearing computer program code embodied therein for use with acomputer, the computer program code comprising: code for receiving datarelating to at least one connection from a network; code for derivingstatistical information relating to the at least one connection; codefor causing disconnection of at least one first connection in dependenceof the statistical information, and wherein the statistical informationcomprises at least one average idle time, wherein the at least one firstconnection is caused to be disconnected responsive to an average idletime exceeding a predefined threshold idle time, the average idle timebeing obtained from averaging idle times of a plurality of secondconnections, distinct from the first connection, the second connectionshaving a parameter that matches a corresponding parameter of the firstconnection.